fix(lambda-python): escape Docker bundling command arguments

[kumsmrit]

Issue # (if applicable)

Closes #.

Reason for this change

• The Python Docker bundling path builds a shell command from generated copy and install commands. Some generated arguments were not escaped consistently with the rest of the Docker bundling command path.

Description of changes

• Standardize shell-argument escaping for Python Docker bundling commands, including copied asset paths, output paths, dependency install targets, and rsync exclude patterns.
• Validate the bundled output path suffix so generated output remains under the bundling output directory.

Describe any new or updated permissions being added

Description of how you validated changes

• Added regression coverage for escaped exclude patterns, escaped output path suffixes, and output path suffixes.
• Updated existing aws-lambda-python-alpha test expectations to reflect standardized argument escaping.
• aws-lambda-python-alpha unit tests pass and aws-cdk-lib builds successfully

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[github-actions]

👋 It looks like your PR description follows the template but is missing a valid issue number in the first section.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to include a reference like Closes #123. If no existing issue matches your change, create one first.

[aws-cdk-automation]

(This review is outdated)

[otaviomacedo]

What if it's already escaped? We should also probably skip the transformation in case arg is unresolved.

[kumsmrit]

For "already escaped": this helper is intentionally a literal-value escaper; callers pass the raw argument value, and the function emits shell syntax that preserves it as one shell word. It is being applied at the point where these values become shell syntax, so there should not be any prior escaping to collide with.

For unresolved tokens: the values here are used for local synth-time bundling and not deploy-time. inputDir is the framework /asset-input constant; outputDir is based on /asset-output; and user-supplied inputs like assetExcludes / outputPathSuffix are plain string inputs consumed by the local bundling command. Even if someone forced an encoded token string into one of those fields, skipping escaping would not make it usable since the Docker/local bundling command runs before token resolution.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-18 16:02 UTC · Rule: default-squash · triggered by rule automatic merge
• 🟠 Checks running · in-place
• 🚫 Left the queue — 2026-08-18 16:04 UTC · at 3ca7dc49399cfb0a2b4d52eb3ad3685152735a04

This pull request spent 1 minute 50 seconds in the queue, with no time running CI.

Waiting for

• any of: [🛡 GitHub branch protection]
  • check-neutral = validate-pr
  • check-skipped = validate-pr
  • check-success = validate-pr
• any of: [🛡 GitHub branch protection]
  • check-neutral = build
  • check-skipped = build
  • check-success = build

All conditions

• any of [🛡 GitHub branch protection]:
  • check-neutral = validate-pr
  • check-skipped = validate-pr
  • check-success = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-neutral = build
  • check-skipped = build
  • check-success = build
• github-review-approved [🛡 GitHub branch protection]
  • fix(lambda-python): escape Docker bundling command arguments #38583

Reason

Pull request #38583 has been dequeued

Queue conditions are not satisfied:

• #changes-requested-reviews-by=0
• check-success=build
• check-success=validate-pr

Hint

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.
If you do update this pull request, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[mrgrain]

The code for this should be centralized and aligned with NodeJS bundling.